MikroORM 7.0.13 – SQL Injection
# Exploit Title: MikroORM 7.0.13 - SQL Injection
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Prodigy Commerce 3.3.0 – Local File Inclusion
# Exploit Title: Prodigy Commerce 3.3.0 - Local File Inclusion
Langflow 1.3.0 – Remote Code Execution
# Exploit Title: Langflow 1.3.0 - Remote Code Execution
Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution
# Exploit Title: Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution
MixPHP Framework 2.2.17 – Unsafe Deserialization Remote Code Execution
# Exploit Title: MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution
CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
# Exploit Title: CubeCart < 6.7.0 - Reflected Cross-Site Scripting
Casdoor 3.54.1 – Arbitrary File Write via Path Traversal
# Exploit Title: Casdoor 3.54.1 - Arbitrary File Write via Path Traversal
EspoCRM 9.3.3 – SSRF
# Exploit Title: EspoCRM 9.3.3 - Authenticated SSRF via Alternative IPv4 Notation
scramble – Remote Code Execution
# Exploit Title: scramble - Remote Code Execution
OpenCATS 0.9.7.4 – SQL Injection
# Exploit Title: OpenCATS 0.9.7.4 - SQL Injection
Grav CMS 2.0.0-beta.2 – Remote Code Execution
# Exploit Title: Grav CMS < 2.0.0-beta.2 - Remote Code Execution (RCE)
Apache HTTP Server 2.4.66 – ‘mod_http2’ Double-Free Denial of Service
# Exploit Title: Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service
WordPress Temporary Login Plugin 1.0.0 – ‘temp-login-token’ Authentication Bypass to Account Takeover
# Exploit Title: Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover
cPanel – CRLF Injection
# ExploitTitle: cPanel 11.40 - CRLF Injection
Cockpit 359 – RCE
# Exploit Title: Cockpit 359 - RCE
BookStack 25.12.1 – Denial of Service
# Exploit Title: BookStack 25.12.1 - Denial of Service
solaredge – (CSRF-OOB-Injection)
# Titles: solaredge - (CSRF-OOB-Injection)
FUXA 1.2.9 – RCE
# Exploit Title: FUXA 1.2.9 - RCE
WordPress Plugin Supsystic Contact Form 1.7.36 – SSTI
# Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI
Apache HertzBeat 1.8.0 – Remote Code Execution
# Exploit Title: Apache HertzBeat 1.8.0 - Remote Code Execution
ePati Antikor NGFW 2.0.1301 – Authentication Bypass
# Exploit Title: ePati Antikor NGFW 2.0.1301 - Authentication Bypass
PJPROJECT 2.16 – Heap Bufferoverflow
# Exploit Title: PJPROJECT 2.16 - Heap Bufferoverflow
Ninja Forms Uploads – Unauthenticated PHP File Upload
# Exploit Title: Ninja Forms Uploads - Unauthenticated PHP File Upload
glances 4.5.2 – command injection
#!/usr/bin/env python3
coreruleset 4.21.0 – Firewall Bypass
# Exploit Title: coreruleset 4.21.0 - Firewall Bypass
Flowise < 3.0.5 - Missing Authentication for Critical Function
# Exploit Title: Flowise < 3.0.5 - Missing Authentication for Critical Function
Ghost CMS 6.19.0 – SQLi
# Exploit Title: Ghost CMS 6.19.0 - SQLi
LuaJIT 2.1.1774638290 – Arbitrary Code Execution
-- Exploit Title: LuaJIT 2.1.1774638290 - Arbitrary Code Execution
Bludit CMS 3.18.4 – RCE
# Exploit Title: Bludit CMS 3.18.4 - RCE
ThingsBoard IoT Platform 4.2.0 – Server-Side Request Forgery (SSRF)
# Exploit Title: ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)
MindsDB 25.9.1.1 – Path Traversal
# Exploit Title: MindsDB 25.9.1.1 - Path Traversal
Traccar GPS Tracking System 6.11.1 – Cross-Site WebSocket Hijacking (CSWSH)
# Exploit Title: Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)
FUXA 1.2.8 – Authentication Bypass + RCE Exploit
# Exploit Title: FUXA 1.2.8 - Authentication Bypass + RCE Exploit
Python-Multipart 0.0.22 – Path Traversal
# Exploit Title: Python-Multipart 0.0.22 - Path Traversal
Repetier-Server 1.4.10 – Path Traversal
# Exploit Title: Repetier-Server 1.4.10 - Path Traversal
HUSTOJ Zip-Slip v26.01.24 – RCE
# Exploit Title: HUSTOJ Zip-Slip v26.01.24 - RCE
BusyBox 1.37.0 – Path Traversal
# Exploit Title: BusyBox 1.37.0 - Path Traversal
JUNG Smart Visu Server 1.1.1050 – Dos
# Exploit Title: JUNG Smart Visu Server 1.1.1050- Dos
SumatraPDF 3.5.2 – Remote Code Execution
# Exploit Title: SumatraPDF 3.5.2 - Remote Code Execution
NiceGUI 3.6.1 – Path Traversal
# Exploit Title: NiceGUI 3.6.1 - Path Traversal
Frigate NVR 0.16.3 – Remote Code Execution
# Exploit Title: Frigate NVR 0.16.3 - Remote Code Execution
Js2Py 0.74 – RCE
Exploit Title: Js2Py 0.74 - RCE
Camaleon CMS v2.9.0 – Path Traversal
# Exploit Title: Camaleon CMS v2.9.0 - Path Traversal
Cybersecurity AI (CAI) Framework 0.5.10 – Command Injection
# Exploit Title: Cybersecurity AI (CAI) Framework 0.5.10 - Command Injection
Erugo 0.2.14 – Remote Code Execution (RCE)
# Exploit Title: Erugo <= 0.2.14 - Authenticated Remote Code Execution (RCE)
deephas 1.0.7 – Prototype Pollution
# Exploit Title: deephas 1.0.7 - Prototype Pollution
SUSE Manager 4.3.15 – Code Execution
# Exploit Title: SUSE Manager 4.3.15 - Code Execution
HAX CMS 24.x – Stored Cross-Site Scripting (XSS)
# Exploit Title: HAX CMS 24.x - Stored Cross-Site Scripting (XSS)
Craft CMS 5.6.16 – RCE
# Exploit Title: Craft CMS 5.6.16 - RCE
phpMyFAQ 4.0.16 – Improper Authorization
# Exploit Title: phpMyFAQ <= 4.0.16 - Improper Authorization